Service robots are required to ensure functional safety by constantly monitoring a safety state using an external sensor and a self-diagnosis device and by executing appropriate safety control logic upon detecting some risk.
IEC 61508 has been established as an international standard for functional safety of the service robots described above as well as systems which operate on an electrical principle, such as transportation equipment. In IEC 61508, a system provided to ensure functional safety is called a safety-related system. IEC 61508 defines various techniques for constructing the safety-related system using hardware, such as a microprocessor and a PLC (Programmable Logic Controller), and a computer program (software). The use of techniques defined in IEC 61508 makes it possible to construct the safety-related system using a computer system.
Meanwhile, in recent years, the throughput of programmable electronic devices, such as a microprocessor, has been improved. Accordingly, various application programs are executed in parallel on a computer system by using a multitask OS (Operating System), thereby enabling integration of computer systems which are mounted in equipment, such as a service robot and a vehicle, for various purposes.
Patent Literature 1, for example, discloses a technique for causing an application program related to ensuring of functional safety (hereinafter, referred to as “safety-related application”) to run on a computer system together with another application program (hereinafter, referred to as “non-safety-related application”).
When the techniques defined in IEC 61508 are applied to the entire software including the safety-related application and the non-safety-related application, a need arises to apply the techniques also to the non-safety-related application. This causes a problem of an increase in software development cost.
Thus, in the technique disclosed in Patent Literature 1, safety-related applications (a safety monitoring program and a safety control program) are made independent from a non-safety-related application (a normal control program) by time partitioning of a system program. Accordingly, the normal control program can be excluded from the safety-related system, which contributes to a reduction in cost of the safety-related system constructed using a computer system.